Description
Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Telegram | Telegram Desktop | < 7.2.9 | 7.2.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | telegram-desktop | 5.7.2+ds-6 | — |
| Debian 12 | telegram-desktop | 4.6.5+ds-2+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | telegram-desktop | No fix yet | — |
| Ubuntu 20.04 LTS | telegram-desktop | No fix yet | — |
| Ubuntu 18.04 LTS | telegram-desktop | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
SeanDishman/telegram-cve-2026-107181 ★ 20 · Oct 10, 2026
Telegram CVE-2026-107181
-
abdugafforov-bobur/cve-2026-107181-poc ★ 8 · Oct 14, 2026
-
00nx/telegram-account-takeover-poc ★ 3 · Oct 13, 2026
CVE-2026-107181 Proof Of Concept for telegram Desktop account take over in windows
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Telegram Desktop one-click account takeover write-up technical-description exploit
- Patch Commit patch
- Telegram Desktop v7.2.9 Release Notes release-notes
- Unescaped IPC record separator (v7.2.8) technical-description
- interpret: send-path handler (v7.2.8) technical-description
- https://github.com/telegramdesktop/tdesktop product
- VulnCheck Advisory: Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme third-party-advisory